A huge thing people forget with WordPress is that most .org-powered sites are on shared hosting. Simple little bugs make it easy to hack an average WP site, but just setting things up right can solve a ton of issues. I'd recommend the digwp.com security recommendations. The book has better info but is pricey.